Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04/05/2024, 19:04
General
-
Target
1412d60920ca86f26dfdbedda2e3786f_JaffaCakes118.exe
-
Size
472KB
-
MD5
1412d60920ca86f26dfdbedda2e3786f
-
SHA1
44843fc5affe697b65fc9431a6f7d4d0d28ced91
-
SHA256
af4bd528b68ac052bb8d00f76e0490f636bbcfd8bafeb02e0ca9cf6a5568ea42
-
SHA512
fc7151cabfca31f852e21a4db1368f0b1f8135c721bb5cb3117b10b6105d63f657082c8c3c9c7ea752d6c75dd6c23b99a9b5ff8b461a059063db2b2ba448280a
-
SSDEEP
6144:Bylu6uz5Y49Bqi5qZ366VuUxY9tRElNCgeVTiARduu0npl:0lpMjof3B8UxYbwCXVTRduJ
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+kjxek.txt
http://t54ndnku456ngkwsudqer.wallymac.com/2E467B70BD69ED24
http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/2E467B70BD69ED24
http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/2E467B70BD69ED24
http://xlowfznrg4wf7dli.onion/2E467B70BD69ED24
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (378) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1412d60920ca86f26dfdbedda2e3786f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1412d60920ca86f26dfdbedda2e3786f_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\dvajtoweqsyj.exeC:\Windows\dvajtoweqsyj.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_ReCoVeRy_.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_ReCoVeRy_.HTM3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:584 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Windows\DVAJTO~1.EXE3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\1412D6~1.EXE2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5230146f1d5ba90d1ca9e56a640b26dd5
SHA1eebf70f985241365b8e29b88f9e8861aff2654f1
SHA256f74ac70bef31b068b1b19bc3fa143eb0a292fde9348d139ffc70b96469f23130
SHA5121b49be7a2fc41b6bf91edba0d2b57ae2472daa3ccad852f80608e158eee05d7ce5bf4dfff4dc4da812763028c65e9dd766ed13be89e72de27c762b02ffa2b91f
-
Filesize
64KB
MD5ac73c5ad972f6e0e6c0f91a9325e7d93
SHA12cacd060976e0e027aa16a09feabe972d917990c
SHA256cc12033a8301753dc0b5e166b05cff552a94858df95d65948d0cf226b17a9524
SHA5129d0bac0ac48ec4c373033f0f519ffc273cde5670afc3a17ca604ade160d528a944ae4e0119c10b0d72bb5489ba6566711b85dcef3af37eff01c8e28f85b8a4c8
-
Filesize
1KB
MD51b14038a1e38af926836bd11332306f1
SHA17fa922becb919432a3a8d3102f7e10d391f14275
SHA25625c5f23fc7d2cf82864494875499ceff57530f40a8d5f047f66d2ca8979fdcc8
SHA5125df455ced426fb19c5d9dcca30ec1cedfafe4188d4019f46cc763e33bd410b5c8f0343939883b0b1424d56e7a900558e8a236abd094410f83f7554b700b16940
-
Filesize
11KB
MD507b1c1ab13cdeac386a150e83bff4e0a
SHA11b6a48f6e5b53c15e6c20a23f03a17c9e7047428
SHA2568af5f2748bb430d28fa6279e670c28765b5e67623b6182bceda150427c49167a
SHA512517f22f571923eea61a14eb81cd4c0a422da8f7e18560e49ef889a2b15ecfeb1922fe5696d73eb4f396a0cae2de8a89dbd7c905c1c1ae87f38f764b4fb342861
-
Filesize
109KB
MD53cb7825945b0045a08624ead0dafa46e
SHA154a10eccc16b0375938478495a7aef0d8744aa00
SHA25657c1dd431fd28458f414aa9b02ee0c9b820a44be7b2e7d6c8ac1da8769e49b73
SHA5122c77d34a1c3b5a190659caeef076fcdc9c8eeb2d8649752b85735fff1aa03f0b918b39b64e4abf3b675a24f09deb6e8f4ee48e046447c802fbc8aa63edd86b79
-
Filesize
173KB
MD5d09d2d07fcbaa060caaa78dddc673549
SHA1dd9f498e96e63bac59b415991001678de19e3dbf
SHA256ce2166565df8da3161ec3320e11c2e291035c58d145358b27d279567043ed1ac
SHA5122c48d73fdaff4b06d6b28ec1e7325abea3cdf9cc25230ef590e8d415003d93c5993e1769baae145854b824c34a4f7ac6d48843dd59f82a1916b5f929fbd9cc8f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD58721140c21408593ca58a94b6618eb97
SHA1b8719984923fbdacb83a1863c0c12f1283730870
SHA2566b85e3cffcb5f5266b72e94e2a804602248a9f6cbdab467199fab4f0722c943a
SHA512325d91bd2f7ab8d245ebd856e6edea7723a6637cd4f8635e42725499989e6ba0ad3b2a58c1a1e9c2d40e26d7116eb8f58157fb0cb94994cc997abe0605799136
-
Filesize
344B
MD5adbbac56f7f2f498fdf2cdf418ad01a5
SHA1bd608bf4160594d7aa90f5375dcfe4361cf1dd91
SHA2566a1824a324ce8d13b947fd40ed90b9da43faecc6a70a16c37486dbf2f096eb49
SHA5122d0e019af785f08a0bb11176b0a2ce09b501ce02eefea81402766002fc649a8e03db82e52bff4961a21816732e0d2d36c2ad17667ec2d7a5b96d4e796313f525
-
Filesize
344B
MD5bee971b2f4fc99524844cea577a3a83c
SHA16bb2fccae9ac74086514232059a9fd9502647f26
SHA256acfb73c49f469f919c2851e484891bc664218baef9a12ace9d031a656b47be69
SHA512ad7f22a360a5dc5421c9d0e8e0a6df7fefab2f618c42d303cd5ff5024c4f0907722424a712e30cda05d097ac5b6e6daca22a35e043c52795819559fd47a66cd0
-
Filesize
344B
MD5002d294893b30d9e48b6dff625569313
SHA1e1156115e932e29c080bdffa07179b69e717f68e
SHA2560d5f88b67d5d61452b937336caed2f7758a430393507b6507d4b3e11cdcaba8d
SHA51223bd53652611f14b56e91bd7c619e56e3bc8b4fca78035e2877a7bd5aa768720f67e6803d2a2240682e2c9f38b43e033ff1c1aef6c510e53196b384e9b7b53bb
-
Filesize
344B
MD59f76e77f8636a7d820960f7817e34486
SHA1d6addbc1d801944aa75d47e788de40da15674c3d
SHA2561c568c451dc742f15ecf3108399a3f07c6d479c12fe39bbfd2375ba4aefeacfc
SHA51231d54177c222c3cb1a51ecd7ef350def80b41f47842637e7f11a9326299bc477e9cb98e5700deaa31459d8c8c533660d4d4f140f093f29904d75d7d51f828bd4
-
Filesize
344B
MD5b41ab1f20271671d661f080b5c34c572
SHA12fe99fdcb63f550ff0686f74a8fef170b995d59c
SHA2569ec7e66904cb77542b650f181a1340f088a4208e3939235623d797c9256228f5
SHA5125a25301a4d82c34bc07a9eb4920ca1628926d7bac7a7c91755550c22563821cc461fb51e7ac9e0f0e1c3d929d79aa7ed3f5157532e23026a2a919fd94f400927
-
Filesize
344B
MD51eb9194e205e3945c7fde38631896beb
SHA18795269f4af4cbe720ce0413273d155836fdc520
SHA25641ba3f2fc184a1f71efbbfa1ffe3b64f07a6fb0e04d172f4928104b6c3327472
SHA512d7c519b14ea6f2530926557a1d998dc877edfb687fad27ec7a66b3143dd4f4252be3dd1a47207ffde41e8896b8544d1c44e0f2be9923fc07f55efcc463ba08ba
-
Filesize
344B
MD53853fc9f72d95ef0bc9b691ecfea9c11
SHA1000ca684dcbbd7d68f26f50e0d9c85d792365364
SHA256027c27313d3f4d3bc03e3034002806287c4a9fd6185faa17584180fbc2add6ca
SHA51259a2f942721daaba9a3bc0434f9f31adbd1e7ef33bed9ebde9e6d5815a7ac88c7b1cb930d4df3debb77e0e57cca93a8046e64a10bb2a848a474f98f0ea419a82
-
Filesize
344B
MD52aa1d2dcaaac9ce80c518a6cacaceabb
SHA1e0f06ac7f94071657dd6a75b1316c17b883e57f0
SHA2566a7cf4c060aa22352c91dd54ddbd18ea9fb64f692fba17d8ae86e17f9ecda536
SHA5123efde57a15fff4d47a290fd42f00bb76eb7688b82b4c8b402b6aab8692be5c758a89b5c0cb408f5c74f2a88118aa753cf5de1ffb759938efbc1d9475668d00d6
-
Filesize
344B
MD5b58c955cafc33f753ce787753ee76f81
SHA1b0d70c220ebff54a902f5cf2777270b57d2025d3
SHA256a24112bee124a0d2b4327ad4faa584cb31f280d789903477961728ba0a44d81a
SHA51236cb305e6d67651100291c0e1498124649bbd0555273e57b77dfde43bd3694bffb96fa8df799858861a10f9b83fbfeebc02247855c27c9100b79d78114f7a7a0
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
472KB
MD51412d60920ca86f26dfdbedda2e3786f
SHA144843fc5affe697b65fc9431a6f7d4d0d28ced91
SHA256af4bd528b68ac052bb8d00f76e0490f636bbcfd8bafeb02e0ca9cf6a5568ea42
SHA512fc7151cabfca31f852e21a4db1368f0b1f8135c721bb5cb3117b10b6105d63f657082c8c3c9c7ea752d6c75dd6c23b99a9b5ff8b461a059063db2b2ba448280a
-
Filesize
536KB
-
Filesize
800KB
-
Filesize
536KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
